AWS is introducing the ability to centrally manage root access for accounts in an AWS Organization via AWS Identity and Access Management (IAM).
Previously, AWS accounts with root access needed to be secured with layers of protection like multi-factor authentication, which security teams needed to manage manually and involved tasks like routinely rotating credentials, securely storing them, and making sure credentials complied with company security policies.
According to AWS, that approach becomes extremely time-consuming as more and more users are added to an AWS environment, and could create delays in provisioning and lead to account takeover if the root access credentials weren’t properly secured.
Central root access management addresses these challenges, and introduces two main new capabilities: central management of root credentials and root sessions.
Central management allows teams to centrally remove long-term root credentials, prevent credential recovery, provision secure-by-default accounts, and maintain compliance by monitoring the status of root credentials across all accounts.
Root sessions are short-term, task-scoped root access, which prevents the need to issue long-term root access and ensures that root access is only being used for the task that requires it. “AWS enables short-term root access for specific actions, adhering to the best practices of least privilege. This limits the scope of what can be done and minimizes the duration of access, reducing potential risks,” AWS wrote in a post.
Root sessions allow users to perform one of five actions: auditing root user credentials, re-enabling account recovery, deleting root user credentials, unlocking an S3 bucket policy, unlocking an SQS queue policy.
This new capability is now available for free for all AWS regions except AWS GovCloud (US) and AWS China Regions, which don’t have root accounts. It can be accessed through the IAM console, AWS CLI, and AWS SDK.
